CVE-2023-5385

The CVE pertains to the WordPress plugin Funnelforms Free (versions up to 3.4). A missing authorization/capability check in the fnsf_copy_posts function allows authenticated users with subscriber-level permissions and above to copy arbitrary posts, effectively enabling unauthorized data modificat...

CVE-2023-5385: Missing Authorization

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfcopyposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5383: Cross-Site Request Forgery (CSRF)

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsfcopyposts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts...